thorsten/phpmyfaq Security Advisories for 4.1.1 (24)
-
[HIGH] phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
PKSA-hycs-5t33-gw1y GHSA-pg62-f8g4-4wqh
Affected version: <=4.1.4
Reported by:
GitHub -
[MEDIUM] phpMyFAQ public FAQ APIs expose inactive FAQ content
PKSA-5ym8-q7sn-cqmx GHSA-mf8r-wm2w-f8c5
Affected version: >=4.1.0,<=4.1.4
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
PKSA-wqvs-f8jk-pt53 GHSA-88g4-74f3-63x9
Affected version: >=4.0.0-alpha,<=4.1.4
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
PKSA-cz4f-38kk-4ywj CVE-2026-47132 GHSA-6pvm-2vjj-rx4w
Affected version: <4.2.0-alpha
Reported by:
GitHub -
[HIGH] phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
PKSA-bgmm-r5q1-dvfj GHSA-985r-q3qp-299h
Affected version: <=4.1.3
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
PKSA-wn7x-tbkv-cqqp CVE-2026-49205 GHSA-8c6h-7g6x-m5x4
Affected version: <4.1.4
Reported by:
GitHub -
[LOW] phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
PKSA-p1ky-vdyf-6r6j CVE-2026-48488 GHSA-58fg-62fg-3fcj
Affected version: <=4.1.3
Reported by:
GitHub -
[HIGH] phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
PKSA-x1b3-f9q9-1brm CVE-2026-35675 GHSA-w9xh-5f39-vq89
Affected version: <4.1.3
Reported by:
GitHub -
[HIGH] phpMyFAQ: Default Empty API Token Authentication Bypass
PKSA-jk8b-rmby-gztg CVE-2026-35672 GHSA-gp95-j463-vv28
Affected version: <=4.1.2
Reported by:
GitHub -
[HIGH] phpMyFAQ: IDOR Account Takeover
PKSA-ttcw-fg74-jv2w CVE-2026-35671 GHSA-xvp4-phqj-cjr3
Affected version: <4.1.3
Reported by:
GitHub -
[HIGH] phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
PKSA-64xv-jbdm-pg2q CVE-2026-35676 GHSA-9qv9-8xv6-5p35
Affected version: <4.1.3
Reported by:
GitHub -
[CRITICAL] phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
PKSA-trv8-7xnx-t8d9 CVE-2026-46364 GHSA-289f-fq7w-6q2w
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
PKSA-djzh-dx9x-j5hd CVE-2026-45008 GHSA-gh9p-q46p-57g2
Affected version: <=4.1.1
Reported by:
GitHub -
[HIGH] phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
PKSA-k9ft-9rnh-h8dn CVE-2026-46366 GHSA-99qv-g4x9-mgc3
Affected version: <=4.1.1
Reported by:
GitHub -
[HIGH] phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
PKSA-n87n-9t5q-zcf5 CVE-2026-46359 GHSA-pm8c-3qq3-72w7
Affected version: <=4.1.1
Reported by:
GitHub -
[CRITICAL] phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
PKSA-q6mm-vp1w-mgjs CVE-2026-45010 GHSA-9pq7-mfwh-xx2j
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
PKSA-42b7-bh2b-d7nn CVE-2026-45009 GHSA-jrc5-w569-h7h5
Affected version: =4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
PKSA-198b-7kr6-ksdh CVE-2026-46361 GHSA-pqh6-8fxf-jx22
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
PKSA-pmsp-dtdj-k1f9 CVE-2026-45007 GHSA-rm98-82fr-mcfx
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
PKSA-sw8q-jkxw-m11r CVE-2026-46360 GHSA-whqh-9pq5-c7r3
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
PKSA-jr2y-dd2x-qtks CVE-2026-46363 GHSA-f5p7-2c9q-8896
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
PKSA-p58s-jb5m-qycz GHSA-7cx3-2qx2-3g6w
Affected version: <=4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
PKSA-b77f-s5cd-b1qh CVE-2026-46362 GHSA-hpgw-ww76-c68r
Affected version: <=4.1.1
Reported by:
GitHub -
[HIGH] phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
PKSA-1zxw-krpv-74xh CVE-2026-46367 GHSA-9525-27vj-c8r8
Affected version: =4.1.1
Reported by:
GitHub